nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ulogd patch from Dan Walsh

Browse Source 
"communicates with mysql and postgres via the network"
This commit is contained in:
Jeremy Solt 2010-11-12 12:25:27 -05:00
parent 8d4ee022e6
commit a00839dcc1
2 changed files with 25 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
policy/modules/services/ulogd.if
View File

@ -119,9 +119,8 @@ interface(`ulogd_append_log',`
#
interface(`ulogd_admin',`
gen_require(`
type ulogd_t, ulogd_etc_t;
type ulogd_t, ulogd_etc_t, ulogd_modules_t;
type ulogd_var_log_t, ulogd_initrc_exec_t;
type ulogd_modules_t;
')
allow $1 ulogd_t:process { ptrace signal_perms };
@ -132,12 +131,12 @@ interface(`ulogd_admin',`
role_transition $2 ulogd_initrc_exec_t system_r;
allow $2 system_r;
files_search_etc($1)
files_list_etc($1)
admin_pattern($1, ulogd_etc_t)
logging_list_logs($1)
admin_pattern($1, ulogd_var_log_t)
files_search_usr($1)
files_list_usr($1)
admin_pattern($1, ulogd_modules_t)
')

18
policy/modules/services/ulogd.te
View File

@ -31,6 +31,9 @@ logging_log_file(ulogd_var_log_t)
allow ulogd_t self:capability net_admin;
allow ulogd_t self:netlink_nflog_socket create_socket_perms;
allow ulogd_t self:netlink_route_socket r_netlink_socket_perms;
allow ulogd_t self:tcp_socket { create_stream_socket_perms connect };
allow ulogd_t self:udp_socket create_socket_perms;
# config files
read_files_pattern(ulogd_t, ulogd_etc_t, ulogd_etc_t)
@ -43,6 +46,19 @@ mmap_files_pattern(ulogd_t, ulogd_modules_t, ulogd_modules_t)
manage_files_pattern(ulogd_t, ulogd_var_log_t, ulogd_var_log_t)
logging_log_filetrans(ulogd_t, ulogd_var_log_t, file)
files_search_etc(ulogd_t)
files_read_etc_files(ulogd_t)
files_read_usr_files(ulogd_t)
miscfiles_read_localization(ulogd_t)
sysnet_dns_name_resolve(ulogd_t)
optional_policy(`
mysql_stream_connect(ulogd_t)
mysql_tcp_connect(ulogd_t)
')
optional_policy(`
postgresql_stream_connect(ulogd_t)
postgresql_tcp_connect(ulogd_t)
')